From 60a5b9242057e57d903caf61fea5012a3810cfa7 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Fri, 6 Nov 2026 09:54:37 +0000 Subject: [PATCH 1/5] fix(bridge): enable optional TOML parser with http feature --- Cargo.toml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/Cargo.toml b/Cargo.toml index 60016c4..7c2d888 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -53,7 +53,8 @@ ureq = { version = "3.3", optional = true } [features] default = [] signing = ["ed25519-dalek"] -http = ["ureq"] +# Patch Bridge is compiled by `http` and parses Cargo manifests/lockfiles. +http = ["ureq", "toml_edit"] sarif = [] # Native GUI viewer (eframe/egui). Opt-in because eframe raises MSRV above the # 1.90 baseline; default builds remain pure-CLI and MSRV-clean. From 5d9d085b920323b31f7f314d93e633f0269e92ee Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Fri, 6 Nov 2026 09:55:08 +0000 Subject: [PATCH 2/5] fix(config): require TOML parser for offline configuration analysis too --- Cargo.toml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/Cargo.toml b/Cargo.toml index 7c2d888..c2d2614 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -45,7 +45,8 @@ hex = "0.4" getrandom = "0.4" walkdir = "2.5" same-file = "1.0" # assail: refuse a KYAML copy that aliases the sealed JSON report -toml_edit = { version = "0.23", default-features = false, features = ["parse"], optional = true } +# Configuration analysis always parses TOML, including offline/default builds. +toml_edit = { version = "0.23", default-features = false, features = ["parse"] } dirs = "7.0" ed25519-dalek = { version = "3.0", optional = true } ureq = { version = "3.3", optional = true } @@ -53,8 +54,7 @@ ureq = { version = "3.3", optional = true } [features] default = [] signing = ["ed25519-dalek"] -# Patch Bridge is compiled by `http` and parses Cargo manifests/lockfiles. -http = ["ureq", "toml_edit"] +http = ["ureq"] sarif = [] # Native GUI viewer (eframe/egui). Opt-in because eframe raises MSRV above the # 1.90 baseline; default builds remain pure-CLI and MSRV-clean. From d08919d7aa55827aefee4e528b06e3f2ed2e339a Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Fri, 6 Nov 2026 09:55:16 +0000 Subject: [PATCH 3/5] test(ci): exercise exact http-only downstream build features --- .github/workflows/verify.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml index 91d0306..e133c95 100644 --- a/.github/workflows/verify.yml +++ b/.github/workflows/verify.yml @@ -113,6 +113,8 @@ jobs: include: - features: '' # default: offline, zero-network build cache-suffix: default + - features: http # exact feature set used by bridge-gate consumers + cache-suffix: http - features: http,sarif # Patch Bridge + SARIF # A cache key may not contain a comma (Swatinem/rust-cache rejects # it at startup of the step), so the matrix carries its own label. From b39b04698f1744289bcd820b560462625679f68d Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Fri, 6 Nov 2026 09:55:42 +0000 Subject: [PATCH 4/5] docs(state): record TOML build repair and pending compilation evidence --- .machine_readable/6a2/STATE.a2ml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.machine_readable/6a2/STATE.a2ml b/.machine_readable/6a2/STATE.a2ml index 21491f0..de374a0 100644 --- a/.machine_readable/6a2/STATE.a2ml +++ b/.machine_readable/6a2/STATE.a2ml @@ -108,3 +108,9 @@ layer-1-0-closure = "stripIsIdentityOnStrippedBody — closes slash-slash induct layer-1-0-block-strings = "Stripping_Block.idr + Stripping_Strings.idr + Stripping_Composition.idr + Stripping_PositionPreservation.idr (PROOF-PROGRAMME row 1 remaining)" hypatia-rule-wiring = "Hypatia ingestion of test_context / ffi_kind / jit_context metadata; ContextSuppressed bucket distinct from RuleSuppressed" gitbot-panicbot-wiring = "gitbot-fleet panicbot translator: surface test_context + suppression-reason in fleet-side reports" + +[repair-2026-11-06-toml-dependency] +change = "toml_edit is required by unconditional assail configuration analysis; remove optional=true" +regression = "Verify matrix adds exact http-only downstream feature combination alongside default and http,sarif" +validation = "TOML/YAML structure and dependency declarations checked locally; Rust toolchain unavailable; compilation and full suite await CI" +status = "candidate; not a verified estate resolution" From 241a74bdbc98f34ac6e15ecc9fbf250de9e63e06 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Fri, 6 Nov 2026 09:58:11 +0000 Subject: [PATCH 5/5] fix(deps): retain reviewed toml_edit 0.25 version recorded in lockfile --- Cargo.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Cargo.toml b/Cargo.toml index c2d2614..b309b59 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -46,7 +46,7 @@ getrandom = "0.4" walkdir = "2.5" same-file = "1.0" # assail: refuse a KYAML copy that aliases the sealed JSON report # Configuration analysis always parses TOML, including offline/default builds. -toml_edit = { version = "0.23", default-features = false, features = ["parse"] } +toml_edit = { version = "0.25", default-features = false, features = ["parse"] } dirs = "7.0" ed25519-dalek = { version = "3.0", optional = true } ureq = { version = "3.3", optional = true }